skip to main content

Commissioner says Data Protection Office effective

Today's is the first annual report since Helen Dixon took over from Billy Hawkes
Today's is the first annual report since Helen Dixon took over from Billy Hawkes

The Data Protection Commissioner has dismissed ongoing criticism of the effectiveness of her office, saying it is well placed to regulate with the full efficacy that its stakeholders deserve.

Helen Dixon made the comments in her annual report for 2014, which shows an almost 50% jump in the number of data breaches notified to her office last year.

The report, published this morning, also shows the number of complaints investigated rose by 50 during the period, to 960.

It is Ms Dixon's first annual report since taking over from Billy Hawkes as head of the Office of the Data Protection Commissioner (ODCP) last year following his retirement.

In it, she says she believes in the "engaged approach" adopted by her predecessor, where data protection problems are detected and either solved or eliminated before they affect a greater number of people than otherwise would have been the case.

She says the controversies involving Irish Water's collection of PPSNs and the Department of Education and Skills Primary Online Database provide a reminder to organisations that information about data collection and use needs to be clear and precise, otherwise confusion and disquiet may be the result.

The report shows that the ODPC received 13,500 queries via its dedicated email service last year, an increase of 1,500 on the previous year.

The largest single source of complaints was problems around access requests, which accounted for 54% of the total, followed by complaints about direct marketing.

However, the figures show progress in reducing the number of cases around misdirected marketing, with the number of complaints in the year falling below 200 for the first time since 2005.

The ODPC also took 27 formal decisions during the year, with 18 of them being upheld.

Following the ruling at the European Court of Justice in the Google "right to be forgotten" case, the ODPC received 32 complaints from members of the public seeking to have particular results delisted from search engines.

The ODPC took nine prosecutions for breaches of the data protection acts during the year, amounting to 162 offences, including a number focused on the illegal accessing by private detectives of personal information.

The ODPC also carried out audits and inspections of 38 organisations, with multinational technology companies and major public service organisations prioritised.

Among those large organisations where audits were completed were Linked-In and An Garda Síochána.

The ODPC says it also engaged with Irish based multinational technology companies during 2014.

For example, it advised Facebook on new features, changes to its privacy settings and its new "Terms and Conditions".

It also engaged with Apple on the proposal to roll out a mobile mapping product and with Microsoft on issues around terms, agreements and the establishment of certain services.

2014 also saw a doubling of the ODPC's budget from €1.8m to €3.5m, with the number of staff growing from 29 to 50 and a new office opening in Dublin.

The expansion and increase in budget follows suggestions at home and from abroad that the ODPC was ill-equipped to handle the workload generated by the large number of technology multinationals here.

The ODPC also took part in the second Global Privacy Enforcement Network Privacy Sweep during 2014.

It saw it analyse 20 mobile apps for privacy. It found that in 55% of cases the privacy information provided by the apps only partially explained the collection, use and disclosure of personal information.

Last year also saw the outlawing of Enforced Subject Access Requests, where a potential employer or organisation obliges a person to make a request for information held about them from a body such as An Garda Síochána.

The ODPC says it will continue to take action to ensure the new rules are rigorously adhered to by potential employers and other organisations.